I think it'd be cool to have pfsense redirect a (incoming) user to /auth endpoint somewhere before accessing any of my services. The user has to login to whatever IDP and then get redirected back to /auth with a jwt or something that the backend app could use to determine if the login succeeded. If so, then some authz check with user@gmail.com that you want to allow. If all good, drop the user IP into a pfsense allow list for 12 hours or something.

Ya I could just wireguard/tailscale everyone, but I run Nextcloud and share files with people sometimes. WG will never fly for one-off file shares. A redirect could be automated where the user installs nothing.

Other options is just move all my public stuff to cloud providers but that just adds up to cash I don't have laying around to burn.

I'm probably trying to reinvent the wheel. Anyone know if something like this already exists?

I have the following rules set up on the WAN tab in pfsense:

I also have this rule set up on the OpenVPN tab:

When I test for open ports with https://dnschecker.org/port-scanner.php
both ports 1194 and 1195 time out.

While trying different things, I created a copy of a port forwarding rule use for port 3389. I forgot to change the redirect target IP and the redirect target port. As a result the rule looks like this:

When this port forwarding rule is enabled, https://dnschecker.org/port-scanner.php shows that port 1195 is open. That leads me to believe 1195 is able to pass through the BWG320.

Thoughts and suggestions as to how to get these ports open and working with OpenVPN will be appreciated.

Prerequisite:

• P2P already established between my two Pfsense firewalls.

• Have access to all necessary networks and clients in both directions without problems.

My problem:

• I want to force one (1), only one, of the clients on the remote side to only use the server side's public IP address for internet access and not "surf" out to the remote side's public IP.

I have searched for solutions on the internet but have not found any solution unfortunately.

So if anyone has a good idea and maybe a guide I would be grateful.

Thanks
Jonna

1. The state bound to the Users interface shows my user IP -> switch IP:443 and the state: CLOSED:SYN_SENT
2. The state bound to the Management interface shows the same user IP -> switch IP:443 but the state: SYN_SENT:CLOSED.

According to pfSense documentation, the left side of the state shows the source side, while the right side shows the destination side.

In the state of the interface through which the packet enters the firewall (PF_IN), the source and destination are swapped: CLOSED:SYN_SENT. The code responsible for the swapping can be seen here: https://github.com/freebsd/freebsd-src/blob/3f79bc9ca336f634e1afa262ccf5155882550a8a/sbin/pfctl/pf_print_state.c#L247

What I don't understand is why did pfSense decide to swap the source and destination when the packet direction is PF_IN (incoming). This is really confusing to me as I expect the left side to show the user sending a SYN packet, but the Users interface state is showing it on the right as if it were the switch that sent the SYN packet.

The question is: why does pfSense decide to swap source and destination states in the inbound interface state (in this case Users interface): CLOSED:SYN_SENT ?

Thank you in advance.

I noticed a blocked connection (no port displayed/logged) from a remote file server that I fetch backups from via an outgoing rsync connection to the remote server over a wireguard VPN on port 873.

(The wireguard tunnel is 10.80.0.0/24, the remote site net is 192.168.0.0/24 and my net is 192.168.42.0/24. The outgoing connection goes out from my NAS, through my pfSense to the remote pfSense box, then onto the remote LAN to their NAS. Each connection is made between 192.168.42.0/24 and 192.168.0.0/24 as the VPN endpoint IPs point to the pfSense boxen. Each pfSense box has a route to the remote site and I only allow 873 through.)

The backup works fine, but I am seeing a denied connection without a port number. Simply identified as 'TCP:' from a private ip (no port) to a private IP (no port).

If I add an easy Rule...

It errors out with 'No port number' but I can't add one - not that I know what port to add.

I haven't noticed TCP traffic without port numbers before.

Any info on what may be causing this?

Thank you.

I know is a few threads like this on the forum, putting my experience in case helps someone else.

I added a new Nic in the box, added interface, set up DMZ. No internet access from DMZ. Devices inside the DMZ got IP's from the DHCP, can ping each other, but can't ping FW, can't ping out, no internet access.

I took another box. Moved Nics over. Fresh install of PF, Restore the same config. Correctly assigned the interfaces. Now on the new box even the LAN can't ping FW and LAN has no internet access. DMZ same, can't ping FW and no internet.

Realized must be something like an underlying config is interfering. Started removing all sorts of config and testing.

Found I had a QOS, Traffic Shaper, for the voip. Deleted this. Instantly everything worked perfect, all fixed.

If adding a DMZ (or second LAN), might need to remove any Traffic Shaper, then add back after.

All the Best ;-)

when i edit a firewall rule with gateway defined

it opens the rule with gateway default

and if you don't pay attention to this (changing something else) and save the rule - the rule is saved with default gateway.